Detecting unknown computer worm activity via support vector machines and active learning

作者：Nissim Nir; Moskovitch Robert; Rokach Lior^*; Elovici Yuval

来源：Pattern Analysis and Applications, 2012, 15(4): 459-475.

DOI：10.1007/s10044-012-0296-4

• Malware detection
• Supervised learning
• Active learning

To detect the presence of unknown worms, we propose a technique based on computer measurements extracted from the operating system. We designed a series of experiments to test the new technique by employing several computer configurations and background application activities. In the course of the experiments, 323 computer features were monitored. Four feature-ranking measures were used to reduce the number of features required for classification. We applied support vector machines to the resulting feature subsets. In addition, we used active learning as a selective sampling method to increase the performance of the classifier and improve its robustness in the presence of misleading instances in the data. Our results indicate a mean detection accuracy in excess of 90 %, and an accuracy above 94 % for specific unknown worms using just 20 features, while maintaining a low false-positive rate when the active learning approach is applied.

• 出版日期2012-11